Malicious code in @years17/n8n-nodes-utils-helper-i (npm)

The npm package @years17/n8n-nodes-utils-helper-i was published with embedded malicious code designed to establish persistent access and exfiltrate system information from infected hosts.\n\nThe malicious payload was implemented in two locations: a postinstall hook (callback.js) that executes during package installation, and the main entry point (index.js) containing identical code. The postinstall hook appends a hardcoded SSH public key (tagged pwn@kali) to the authorized_keys file for multiple system users (root, ubuntu, node, runner, and devuser), granting the attacker persistent SSH access. The same code in index.js ensures the implant executes even when npm's --ignore-scripts flag is used.\n\nUpon execution, the malicious code performs host reconnaissance by running commands (id, hostname, sudo -n id, /home listing, docker.sock presence check) and base64-encodes the output. This reconnaissance data is then exfiltrated via HTTPS GET request to jasabersama.id/portfolio-data.php with TLS verification disabled, allowing the attacker to bypass certificate validation.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository (MAL-2026-13878).